AI Agent — a new insider: how to limit access before launch

What exactly Microsoft stated — and what does not follow from it

On October 19, 2026, Microsoft called AI agents the "new insiders" of an organization. This does not mean that every agent is malicious. Risk arises when a single system simultaneously holds credentials, sees internal data, reads untrusted content, and can quickly perform actions on behalf of a person.

Microsoft's recommendations include four practical steps: know all agents, their owners, and their purpose; limit access and actions before launch; protect data, tools, and the execution environment; and constantly adapt behavioral monitoring. TechCrunch also noted another important detail: monitoring should ideally be separated from the model provider so that one system is not both the executor and the sole auditor.

A password outside the agent's context is useful, but not enough

On October 22, 2026, 1Password introduced 1Password for Agents. According to the company, the agent confirms its identity with a separate digital key, the human sees the request and approves specific access, and the password manager fills in the credentials on the site without showing the password to the model. This reduces the risk of a secret ending up in a prompt, log, or chat history.

But a hidden password does not make an action correct. An agent with a successful login can still open the wrong account, send the wrong form, or follow an instruction from a malicious page. Therefore, before trusting any "credential broker," check four separate things:

• What exactly is being approved: just the login, or also the specific next action?
• How long the access lasts: one request, one session, or permanently?
• What the log sees: who requested access, to which service, and what happened after login?
• How to stop it: can the session be instantly revoked and the previous state restored?

Three layers that should not be mixed

In its own materials on the secure launch of coding agents, OpenAI also recommends isolation, network restrictions, reviewing changes, and approving sensitive actions. Anthropic is researching the monitoring of unwanted autonomous actions. This does not mean the problem is solved; on the contrary, different labs recognize the need for protective layers beyond the model itself.

Free AI Agent access map

Choose the most sensitive type of data and the strongest action your scenario will actually allow. The calculation is performed in the browser. The form has no text fields, and the analytics only receive the risk level and the number of recommended controls — not the selected access rights.

Why one "safe" feature doesn't save a dangerous combination

Five launch stages instead of one big permission

1. Describe one task. Not "manage marketing," but "compile a draft report from three allowed tables."
2. Run in read-only mode in a copy. Output is a file or draft that changes nothing externally.
3. Add one reversible action. For example, creating a draft with a diff, a log, and a cancel button.
4. Leave a gateway before the consequence. Publishing, messaging, payment, deletion, and changing permissions require separate confirmation.
5. Test the emergency scenario. Revoke the token, stop the process, find the action in the log, and restore the previous state.

For a small Ukrainian business, this often means discipline rather than an expensive platform: a separate service account, minimal roles, a test database, a limit per operation, and a clear log. You don't necessarily need to buy a complex security product before a real scenario arises.

Prompt for authority review

Insert before technical launchYou are an independent security reviewer. Do not perform actions or ask for secrets. Scenario: [one specific agent task] Data: [sources and most sensitive class] Tools: [API, files, browser, email] Allowed actions: [read / write / publish] Human confirmation: [exactly where] Log and revocation: [how they work] Return: 1) minimal permissions for the scenario; 2) three worst-case plausible errors; 3) boundaries that reduce the radius of each error; 4) emergency stop test; 5) what needs to be removed before production.

After the response, check the settings manually. The prompt cannot see real IAM policies, inherited roles, or environment secrets unless you describe them; there is no need to send the actual secrets into the chat.